CVE-2025-6984: LangChain EverNoteLoader XXE Vulnerability

CVE-2025-6984 Overview

CVE-2025-6984 is an XML External Entity (XXE) vulnerability in the EverNoteLoader component of the langchain-ai/langchain project. The flaw exists in version 0.3.63 and stems from insecure XML parsing using etree.iterparse() without disabling external entity references. An attacker can craft a malicious ENEX (EverNote export) file containing external entity declarations. When the loader processes this file, the parser resolves the external entities and discloses sensitive local file contents such as /etc/passwd. The vulnerability is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Attackers can exfiltrate sensitive local files from systems running vulnerable LangChain EverNoteLoader instances by supplying crafted XML documents.

Affected Products

langchain-ai/langchain version 0.3.63
EverNoteLoader document loader component
Python applications integrating LangChain document ingestion pipelines

Discovery Timeline

2025-09-04 - CVE CVE-2025-6984 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6984

Vulnerability Analysis

The EverNoteLoader component processes ENEX files, which are XML-based EverNote export archives. The implementation uses Python's lxml.etree.iterparse() function to stream through XML elements without configuring secure parser options. By default, iterparse() resolves external entities defined within a Document Type Definition (DTD), which enables classic XXE exploitation.

An attacker who can supply or influence the input ENEX file controls the XML payload reaching the parser. The parser dereferences external entity URIs at parse time, returning the contents of referenced local files or making outbound network requests. This results in confidentiality loss without requiring authentication or user interaction beyond submitting the document.

The EPSS score of 1.92% places this vulnerability in the 83rd percentile for exploitation likelihood, reflecting the well-documented nature of XXE attacks against Python XML parsers.

Root Cause

The root cause is the absence of secure XML parser configuration. The etree.iterparse() call does not pass resolve_entities=False or use a custom parser with entity resolution disabled. Python's lxml library, while safer than xml.etree, still requires explicit hardening for untrusted input. The loader assumes ENEX inputs are trusted, which fails when documents arrive from external users, shared drives, or automated ingestion pipelines.

Attack Vector

Exploitation requires the attacker to deliver a crafted ENEX file to a vulnerable LangChain application. The malicious XML defines an external entity that references a local file path or remote URL. When EverNoteLoader parses the document, the parser substitutes the entity value with the referenced content, which is then exposed through application output, logs, or downstream LLM context. Common targets include /etc/passwd, application configuration files, cloud metadata endpoints, and SSH key material.

The vulnerability is exploitable over the network with low complexity and no privileges required. No verified public exploit code is currently available, though XXE payload patterns are widely documented. See the Huntr Bounty Report for technical details on the disclosure.

Detection Methods for CVE-2025-6984

Indicators of Compromise

ENEX or XML files containing <!DOCTYPE> declarations with <!ENTITY> definitions referencing SYSTEM identifiers
Outbound network requests originating from LangChain processes to attacker-controlled hosts during document ingestion
Unexpected file reads of sensitive paths such as /etc/passwd, /etc/shadow, or ~/.ssh/ by Python processes
LLM prompt or response logs containing fragments of system files or internal configuration

Detection Strategies

Inspect XML and ENEX documents for DTD declarations and external entity references prior to ingestion
Monitor LangChain application processes for anomalous file access patterns outside expected document directories
Log and review all calls to EverNoteLoader.load() with the source document path and size for forensic correlation
Alert on outbound DNS or HTTP traffic from document-ingestion workers to non-allowlisted destinations

Monitoring Recommendations

Enable file integrity monitoring on sensitive paths frequently targeted by XXE payloads
Track Python lxml parsing activity through application performance monitoring with custom instrumentation
Forward web application and ingestion service logs to a centralized analytics platform for correlation
Establish baselines for expected document sources and flag deviations

How to Mitigate CVE-2025-6984

Immediate Actions Required

Audit applications for use of EverNoteLoader and identify all ingestion entry points
Restrict ENEX document sources to trusted internal users until a patched version is deployed
Apply network egress filtering to LangChain workers to block unauthorized outbound connections
Run document-ingestion services with least-privilege accounts that cannot read sensitive system files

Patch Information

No official patched version is referenced in the NVD entry at the time of publication. Monitor the LangChain project repository and the Huntr Bounty Report for fix releases. Upgrade beyond version 0.3.63 once a security release addressing the EverNoteLoader XML parsing logic is published.

Workarounds

Replace EverNoteLoader with a custom loader that calls lxml.etree.iterparse() with resolve_entities=False and a hardened XMLParser configuration
Pre-process ENEX inputs to strip <!DOCTYPE> and <!ENTITY> declarations before passing them to the loader
Containerize the ingestion service with read-only filesystem mounts and seccomp profiles restricting file access
Disable network access for ingestion containers when external entity resolution is not required

bash

# Configuration example: hardened lxml parser settings for XML ingestion
python - <<'EOF'
from lxml import etree

parser = etree.XMLParser(
    resolve_entities=False,
    no_network=True,
    load_dtd=False,
    dtd_validation=False,
)

with open("document.enex", "rb") as fh:
    tree = etree.parse(fh, parser=parser)
EOF